Business Rules Friday, January 23, 2015 Dr. McHenry asked the group: Is this an example of a business rule? (Holding up a long spread sheet formula from a company—a forecasting model that his students are working on). Dr. McHenry is concerned about the dangers embedded in this formula. The formula that he is referring to is in an Excel document, which is used as a forecasting model. IT EXECUTIVE EXCHANGE 2014-­‐2015 Dangers of Storing a Business Rule in a Formula The inherent dangers lurking in a formula like this are great. The person who wrote this formula and created this excel document may no longer be employed with the company, there could be a typo within the formula, the formula could have been copied wrong and in turn the consistency in other documents or in future formulas are then also incorrect, or even the accuracy of the formula could be a significant concern for the company. So, is this formula a business rule? And if so, what can be done in order to protect it? What are Business Rules? Whether a certain formula within a spreadsheet is a business rule is really dependent on the company and the people disseminating that information. Some companies may see this spreadsheet as a pseudo or a shadow (rogue) IT function, while others may use this spreadsheet to make critical financial decisions. Depending on these factors, the IT departments within those companies can address whether certain “care” should be established. The question that should be asked is really “how important are these spreadsheets?” If the purpose of the spreadsheet is for individuals to be able to interrogate data and then use actual ERP tools to provide the information to key financial players within the company, then isn’t that the purpose of spreadsheet programs such as Excel? Many departments within businesses use Excel documents to analyze data, and use them on a daily basis. If these daily uses are becoming significant, then should the ERP be re-­‐
evaluated? Perhaps the ERP tools are not as current as the business needs. Thus the concern comes down to what category of a business rule is it? Dr. McHenry identified three key Business Rules Friday, January 23 2015 business rule categories: 1) rules based on automation and are embedded in software in which a person would need to be responsible for the creation and maintenance; 2) business rules that are not exercised correctly because people are not trained well such as using an Excel document for which the ERP system may already accommodate; and 3) not formalized business rules but “rules” used in spreadsheets or other forms in order to process data. Try thinking of business rules differently. Look at what you are responsible for versus what you should be responsible for. Give yourself a chance to see what could go wrong before you head straight into the iceberg! One company had an intern look at all the Access documents “laying” around within the company. There were massive amounts of these documents, over 14,000 Access databases! More in-­‐depth analysis revealed the company could immediately eliminate a good 12,000 databases because the employee could get the information from somewhere else. The amount was an eye-­‐opener for management. Employees had created these databases over many years believing they needed them to do their jobs, and some actually did need them. The concern for the IT Department became, did employees have these databases on their laptops, did they take them home, and who else essentially had the ability to open these programs up and see those business rules? Another significant concern in having business rules in Excel documents and the loss of control. ERP packages have source code and you have control over it, but IT departments lose control of these rules and the data when spreadsheets are created and the data interrogated is used for key decisions within the business. Of particular concern is the future implication of business rules in these spreadsheets. The use of a correction factor for one year could be inadvertently carried on to year after year thus creating a wrong forecast/report. This becomes serious due to the implications of Sarbanes Oxley and the (possible incorrect) data used to make significant financial Business Rules Friday, January 23, 2015 decisions. Could this wrong data end up on Financial Statements? lose our clients; 2) regulatory rules; and 3) Sarbanes Oxley rules that the company needs to adhere to. Another issue in business rules not in IT’s control is the How to Control Business Rules? transitioning of new software and procedural systems. Can you control the data and business rules by taking One company is implementing a new system. access away from the people? How does this affect Transitioning to the new system became increasingly agility? Do we not concern ourselves with the Excel difficult because some business rules were not type of documents and just rely on auditors to make apparent. Even though that company is a very tenured sure the data is being accurately regulated for Sarbanes company, some individuals had left the company or Oxley and other financial purposes? Perhaps this is the switched departments. Some of the individuals had wrong information and other rules were not in physical cleanest way to overcome the issues related to control. form. The underlying concept of IT is to “do tomorrow Or perhaps to prevent employees from creating these what you did today” which is such an easy statement rules or pseudo rules in spreadsheet documents, you but became ultimately an extreme concern. In order to need to demand more from your software do this, the company has about six providers so that you can capture all the employees familiar enough with the Can you control the needs of the employees. And, maybe the code that they are searching it. data and business rules employee users haven’t been demanding Consistency of the data becomes a by taking access away enough from the IT departments. major hurdle and one that is a real from the people? How issue when under state guidelines Even more concerns about transitioning does this affect agility? and insurance type of regulations. ERP versions, is how to make yourself data is bad, If you do any type of conversion and your then everything else produced is bad as well. If you clean your data up, then you may be able to take a better approach. Companies need to have better controls on their data and whom they give it out to. If control is established, then a company can be more proactive in creating protocols for their business rules and who has access to them. Really, the asset we are protecting is our data. Our business and people make this protection possible! Are Business Rules Different from Code What is the difference between a business rule and code? The code is a representation of a particular business rule. Problems can occur when the business rule changes. The essence of the problem becomes how to effect the change. In turn, people are constantly reinventing ways to process data and for this reason, what once was a solid infrastructure becomes less solid and the need to re-­‐evaluate the information systems becomes necessary. Managing risk, and insuring business rules have to be followed so the owner doesn’t lose the company, is of greatest importance. Does it matter that there are Excel documents with possible business rules in them? Maybe or maybe not, it depends on the type of data in those documents. In the banking/financial industry, the rules can be broken down into three categories: 1) rules our clients define and if we don’t follow them we agile enough for change and growth. Another company understood the need for agility recently when facing the hurdle of new Uber drivers. There was a definite need by the company to be quick to respond in underwriting so that Uber drivers could be covered. Can business rules be internal and not be able to actually validate them? Employee users have these “rule” in their mind but are unable to formulate them into an actual physical rule. Perhaps this could be some of the issues with agility. Also, the business rules that make your business unique are embedded in your legacy system. Some companies say that they pay to be agile. They have bought this agility through software experts that come in a do the “hard” part of maintenance and strategic growth! Generally, IT has a problem with agility in response to business conditions. The differences of agility issues come in package versus homegrown software. With package software, your agility is more compromised and you may not be able to change it as needed. Homegrown software can also create some headaches with regard to being able to handle the amount of agility needed and again the lack of control inherent in the outside programs such as Excel and Access. (Prepared by Jen Taylor and Prof. B. S. Vijayaraman)